Simon Josefsson
blog.josefsson.org · Personal blog · on HN since 2012
Simon Josefsson writes about cryptography, GnuPG and YubiKey setups, Debian packaging, and reproducible builds.
What HN saysHN commenters link his YubiKey and GnuPG master key guide for people interested in smartcards, and the blog comes up in post-quantum SSH discussions.
15HN people shared it
2linked it in comments
24stories submitted
132story points
10 months agolast shared
2012people per year2026
Most-shared posts
- 1Why I don’t Use 2048 or 4096 RSA Key Sizes2 people · 7 points · first shared 2016 · discussion on HN
- 2Coping with Non-Free Debian2 people · 2 points · first shared 2023 · discussion on HN
- 3Offline GnuPG Master Key and Subkeys on YubiKey NEO Smartcard2 people · 2 points · first shared 2015 · discussion on HN
- 4Debian Taco – Towards a GitSecDevOps Debian2 people · 2 points · first shared 2026 · discussion on HN
- 5Towards Idempotent Rebuilds?1 people · 59 points · first shared 2024 · 68 comments on HN
- 6Binary Distribution Rebuilds1 people · 30 points · first shared 2025 · 5 comments on HN
- 7Apt archive mirrors in Git-LFS1 people · 14 points · first shared 2024 · 3 comments on HN
- 8Reproducible and minimal source-only tarballs1 people · 3 points · first shared 2024 · 1 comments on HN
- 9Reproducible Software Releases1 people · 1 points · first shared 2025 · discussion on HN
- 10Sigstore protects Apt archives: apt-verify and apt-sigstore1 people · 1 points · first shared 2023 · discussion on HN
- 11Building Debian in a Gitlab Pipeline1 people · 1 points · first shared 2025 · discussion on HN
- 12Validating Debian/Copyright: Licenserecon1 people · 1 points · first shared 2023 · discussion on HN
- 13Scrypt in IETF1 people · 1 points · first shared 2015 · discussion on HN
- 14OpenPGP Key on FST-01SZ1 people · 1 points · first shared 2022 · discussion on HN
- 15SSH Host Certificates with YubiKey NEO1 people · 1 points · first shared 2016 · discussion on HN
What HN people wrote when they linked it
throw0101a · 2025-08-11
> NTRU Prime (sntrup) is there mostly as a quirk of history (mlkem wasn't available when SSH went down the road of doing PQ).
ML-KEM (originally "CRYSTALS-Kyber") was available, it's just the Tiny/OpenSSH folks decided not to choose that particular algorithm (for reasons beyond my pay grade).
NIST announced their competition in 2016 with the submission deadline being in 2017:
* https://en.wikipedia.org/wiki/NIST_Post-Quantum_Cryptography_Standardi…
TinySSH added SNTRUP in 2018, with OpenSSH following in 2019/2020:
* https://blog.josefsson.org/2023/05/12/streamlined-ntru-prime-sntrup761…
SSH just happened to pick one of the candidates that NIST decided not to go with.
tetraodonpuffer · 2015-12-27
for folks interested in more on yubikeys and gpg I also would suggest these two blog posts
http://viccuad.me/blog/secure-yourself-part-1-airgapped-computer-and-G…
http://blog.josefsson.org/2014/06/23/offline-gnupg-master-key-and-subk…